From first hand experience I can tell you that Uber was recruiting to start their information security program at least 18 months ago and when I spoke to their software engineers and SREs they had a decent understanding of modern security issues.

In the 18 months since I assume they have assembled a decent security team and while most likely Uber dropped the ball here at least they recognized the need for security before they got burnt.